Analysis
- max time kernel
62s - max time network
100s - platform
windows7_x64 - resource
win7v20201028 - submitted
11/12/2020, 15:33
Static task
static1
Behavioral task
behavioral1
Sample
wp-scan.php.dll
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target wp-scan.php.dll
- Size 520KB
- Sample201211-lrjc74mj2e
- SHA256 0e70968a9326d7abc103c04b4c355649c837c69c92b83af9ac4e2c1c123f0948
- MD5 976a3e1f72f6d0e32e5eaab7db1c93b4
- SHA1 77aff7c16b978445d7b4b7a9d2b1eaef0592b439
- SHA512 a29993ba569f5ef123054c8dd8a0ed71c04c5dfb573dd2c9917deed7f1c870732c24bfd2c387a93c539a09d635dde4d89dc048179e3dfc7e5edc9da679d54e0e
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
zloader
Botnet
-
nut
Campaign
-
11/12
C2
-
https://www.businessinsurancelaw.com/wp-punch.php
-
https://squire.ae/wp-punch.php
-
https://lamun.pk/wp-punch.php
-
https://www.rcclabbd.com/wp-punch.php
-
https://thecype.com/wp-punch.php
-
https://theterteboltallbrow.tk/wp-smarts.php
rc4.plain
rsa_pubkey.plain
Signatures
- Blocklisted process makes network request 30 IoCs
flow pid Process 7 844 msiexec.exe 9 844 msiexec.exe 11 844 msiexec.exe 13 844 msiexec.exe 15 844 msiexec.exe 16 844 msiexec.exe 17 844 msiexec.exe 18 844 msiexec.exe 19 844 msiexec.exe 20 844 msiexec.exe 21 844 msiexec.exe 22 844 msiexec.exe 23 844 msiexec.exe 24 844 msiexec.exe 25 844 msiexec.exe 26 844 msiexec.exe 27 844 msiexec.exe 28 844 msiexec.exe 29 844 msiexec.exe 30 844 msiexec.exe 31 844 msiexec.exe 32 844 msiexec.exe 33 844 msiexec.exe 34 844 msiexec.exe 35 844 msiexec.exe 36 844 msiexec.exe 37 844 msiexec.exe 38 844 msiexec.exe 40 844 msiexec.exe 42 844 msiexec.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1748 set thread context of 844 1748 rundll32.exe 30 - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSecurityPrivilege 844 msiexec.exe Token: SeSecurityPrivilege 844 msiexec.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1776 wrote to memory of 1748 1776 rundll32.exe 25 PID 1776 wrote to memory of 1748 1776 rundll32.exe 25 PID 1776 wrote to memory of 1748 1776 rundll32.exe 25 PID 1776 wrote to memory of 1748 1776 rundll32.exe 25 PID 1776 wrote to memory of 1748 1776 rundll32.exe 25 PID 1776 wrote to memory of 1748 1776 rundll32.exe 25 PID 1776 wrote to memory of 1748 1776 rundll32.exe 25 PID 1748 wrote to memory of 844 1748 rundll32.exe 30 PID 1748 wrote to memory of 844 1748 rundll32.exe 30 PID 1748 wrote to memory of 844 1748 rundll32.exe 30 PID 1748 wrote to memory of 844 1748 rundll32.exe 30 PID 1748 wrote to memory of 844 1748 rundll32.exe 30 PID 1748 wrote to memory of 844 1748 rundll32.exe 30 PID 1748 wrote to memory of 844 1748 rundll32.exe 30 PID 1748 wrote to memory of 844 1748 rundll32.exe 30 PID 1748 wrote to memory of 844 1748 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\wp-scan.php.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\wp-scan.php.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:844
-
-